{"id":"4cb5a216-a688-4368-a1f2-b2652bb0ca69","arxiv_id":"2607.04718","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":6.5,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"FORGE poisons deep-research planning with coordinated fake reasoning documents, reaching 26.4% PRISM report contamination at five injections; Root Query Anchoring halves that severity.","lead":"Deep research agents can be steered by a few planted web documents that hijack their follow-up questions, not just the final wording. The paper shows this planning-layer attack, measures how badly reports get contaminated, and offers a simple root-query check that cuts the damage roughly in half.","discovery_kind":"new_method","skeptic_critique":{"model":"grok-4.5","headline":"The transplant isolates planning as dominant only under the same offline reranker that defines Network PRISM; live-web ranking could break both the attack surface and the causal claim.","rationale":"The reader's weakest assumption correctly identifies the Network simulation as the softest load-bearing condition. I sharpen it: the simulation is not only an upper-bound issue for absolute PRISM; it is the shared substrate of the causal transplant that elevates 'subtask hijacking' from correlate to mechanism. Without live admission of the inter-document chain into the planner's initial retrieval D(0), Eq. (4) never fires and Fig. 4's asymmetry is uninformative about real agents. Other concerns (uncalibrated PRISM weights 4-8, 10-query defense subset with higher baseline 38.5%, human-supervised document construction) are real but secondary: Appendix D shows ordinal trends stable under alternative weights, and Local vs Network plus cross-framework Appendix E already bound absolute magnitudes. The paper is careful (offline-only, artifacts withheld, RQA improves utility). No change from CONDITIONAL is warranted; the contingency should explicitly include a live-ranking transplant, not only 'live-web validation' of aggregate PRISM.","tokens_in":22126,"tokens_out":706,"duration_ms":6289,"concrete_test":"Re-run the Fig. 4 transplant and the j=5 Network PRISM protocol on a live search index (or a public web crawl with domain-authority/freshness/spam features) for the same 25 queries and FORGE sets: inject only via public URLs, let the production ranker select top-m, then measure (i) fraction of FORGE docs that enter D(0) and Di, (ii) nc of V-aligned subtasks, and (iii) PRISM under fixed j=1 vs j=5 plans. If FORGE admission falls enough that the nc:1->5 PRISM lift shrinks below the retrieval-injection lift, the planning-dominance claim does not transfer.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The strongest claim rests on two linked results: Network FORGE reaches 26.4% PRISM at j=5, and the 2x2 transplant (Fig. 4) shows that swapping the j=5 subtask list (nc:1->5) raises PRISM far more than scaling retrieval injection under a fixed j=1 plan (14.1% stays 14.1% vs. 22.8%/29.5%). Both results use the same Network simulation (§6.1): m real API docs + j adversarial docs, reranked by Eq. (1) with alpha=0.4 BM25 + text-embedding-3-small cosine, top-m only. Limitations §9 already flags that this omits domain authority, freshness, and anti-spam. If live ranking systematically demotes the coordinated FORGE chain (or admits only isolated docs), the planner never absorbs V-aligned framing into T* (Eq. 4), so the transplant's 'subtask list is the dominant channel' finding becomes an artifact of an offline pool that already over-admits coordinated adversaries. The planning-layer narrative and the 26.4% Network figure then fail together, not independently.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.5","summary":"The paper argues that deep research agents expose a planning-layer poisoning surface: adversarial documents that enter early retrieval can hijack subtask generation and compound into report-level contamination. It introduces FORGE, a two-level attack combining intra-document fabricated reasoning chains with inter-document argument coordination; PRISM, a weighted claim-infection metric over five cognitive types; and Root Query Anchoring (RQA), which re-conditions recursive subtask generation on the root query. Empirically, on gpt-researcher across 25 queries, Network FORGE reaches 26.4% PRISM at j=5, shows depth migration from framing into factual claims, and a 2×2 transplant (Fig. 4) attributes most of the gain to the poisoned subtask list rather than extra retrieval injection under a fixed plan. On a 10-query subset, RQA cuts PRISM from 38.5% to 18.3% while raising RACE utility from 0.5000 to 0.6173, with supporting ablations, baselines, human validation of the evaluator, and cross-framework checks.","tokens_in":22510,"tokens_out":1418,"duration_ms":25888,"significance":"If the results hold under the stated threat model, the paper identifies a genuine and under-studied failure mode for multi-round research agents: epistemic corruption of planning rather than single-hop RAG answer corruption or action hijacking. Strengths include a clear threat model, a structured attack construction, a severity metric with human spot-checks (Appendix C: 92.7% claim-type agreement; 94.7% infection-label agreement), a causal transplant isolating the planning channel (Fig. 4), ablations against PoisonedRAG/AuthChain and structural variants B1/B2 (Table 3), a defense that improves utility rather than only reducing attack success (Table 4), careful dual-use handling (restricted attack artifacts), and released evaluation/defense-oriented code. These make the work useful for both agent security and system design even if absolute Network PRISM is treated as an upper bound.","major_comments":[{"comment":"§6.1 and Eq. (1): Headline Network results (abstract; Fig. 2: 26.4% PRISM at j=5) and the causal transplant (Fig. 4) both depend on the same offline pool—m API documents plus j adversaries, reranked by α=0.4 BM25 + embedding cosine, top-m only. Limitations §9 correctly call this an upper bound omitting domain authority, freshness, and anti-spam, but the abstract and §7.2 present the planning-dominance claim without that qualifier. If live ranking systematically demotes coordinated chains, both absolute Network PRISM and the transplant’s “subtask list is the dominant channel” finding can shrink together. Please either (i) add sensitivity over α, pool size m, and simple authority/freshness proxies, or (ii) reframe abstract/main claims so Local mechanism + upper-bound Network are clearly separated, and state that Fig. 4 is conditional on the simulated admit rate.","section":null},{"comment":"§5, Eq. (6) and Table 1: PRISM’s primary reported severities (26.4%, 38.5%, defense deltas) use uncalibrated weights 4–8. Appendix D shows ordinal stability across schemes, which is good, but main-text tables and the abstract still lead with weighted PRISM alone. Because causal/framing types (weights 7–8) are exactly where FORGE concentrates (Table 3), absolute PRISM can overstate severity relative to unweighted infection. Report unweighted ASR (and ideally macro-avg) alongside PRISM in Fig. 2, Table 2, Table 3, and Table 4, and state explicitly that weights are a design choice pending human-perception calibration (§9).","section":null},{"comment":"§7.3 / Table 4 vs §6.2: Attack scaling and depth results use 25 queries; defense and baseline comparisons use a stratified 10-query subset where FORGE already scores 38.5% PRISM—well above the 26.4% full-set Network figure. That selection inflates the apparent absolute defense problem and makes RQA’s −20.2 point drop hard to compare to the main attack curve. Either run RQA (and the main baselines) on the full 25-query Network j=5 setting, or justify the subset statistically and report full-set RQA PRISM/utility as the primary defense result.","section":null}],"minor_comments":[{"comment":"Fig. 3: Depth migration is central; add error bars or per-query variance and state whether the framing→factual shift is significant, not only visual.","section":null},{"comment":"Table 2 / Appendix H: Category names are clear, but list the five concrete queries per category (or a representative example) in the main text or appendix so readers can assess narrative construction difficulty.","section":null},{"comment":"§4.3 Eq. (4): The notation t̂ ∼ V is informal; define the operational criterion used to mark a subtask as V-aligned in the transplant and pipeline metrics (Appendix F).","section":null},{"comment":"Appendix E: Cross-framework absolute PRISM is much lower (Perplexica 7.5%, DeerFlow 15.9%). A short main-text sentence should caution against portability of the 26.4% figure across retrieval architectures (already noted in §9).","section":null},{"comment":"Typographical consistency: “PRISMmetric” / “FORGE(Fabricated…” spacing in the abstract; “o4-mini” vs model naming elsewhere; ensure arXiv ID / code URL formatting is uniform.","section":null},{"comment":"§2.2: PoisonedRAG and AuthChain are compared under Network j=5 on the 10-query subset only; note whether their documents were optimized for the same retriever (Eq. 1) as FORGE to keep the comparison fair.","section":null}],"recommendation":"major_revision","confidential_remarks":"Solid empirical security paper with a real systems contribution and unusually careful dual-use hygiene. The main risk is over-reading Network absolute numbers and the transplant as live-web facts; if the authors reframe and add the requested reporting/sensitivity, this is close to a strong accept at a security/AI venue. Scope fits cs.AI / agent security well. No integrity red flags in the disclosed evaluation design."},"author_rebuttal":null,"desk_editor":{"model":"grok-4.5","letter":"The useful takeaway is simple: recursive plan–retrieve–synthesize agents have a planning-layer surface that single-hop RAG poisoning papers mostly miss, and FORGE is a concrete way to hit it. The two-level construction (intra-document fabricated chains plus inter-document coordination), the PRISM weighted claim metric, the 2×2 transplant that isolates subtask-list hijacking from extra poisoned evidence under a fixed plan, and Root Query Anchoring are the actual new pieces. The transplant is the cleanest result: under a j=1 plan, scaling retrieval injection leaves PRISM flat at 14.1%; swapping in the j=5 plan moves it a lot more. Depth migration—framing turning into factual-looking premises as δ grows—is also well shown and matches how these systems actually write.\n\nWhat they do well: clear threat model, honest dual-use handling (no attack corpora released), human checks on claim typing (92.7% overall, 84.5% on the causal audit) and infection labels (~95%), ablations against PoisonedRAG/AuthChain and B1/B2, and directional replication on Perplexica and DeerFlow. RQA cuts PRISM 38.5→18.3 on the defense subset while raising RACE utility, which is the right kind of defense result.\n\nSoft spots, in proportion. The Network figure (26.4% at j=5) and the transplant both run on the same offline pool: m API docs + j adversaries, α=0.4 BM25+embedding rerank, top-m only. Limitations already say this omits domain authority, freshness, and anti-spam, so treat Network PRISM as an upper bound, not a field estimate. If live ranking systematically breaks the coordinated chain, both the absolute number and the “planning is dominant” story weaken together—that stress-test concern is real, not pedantic. PRISM weights 4–8 are design choices; sensitivity checks keep the ordinal story, but human calibration is still missing. Defense numbers use the higher-attack 10-query subset, so do not over-generalize the absolute drop. None of that sinks the planning-layer narrative or the RQA direction.\n\nThis is for people building or hardening deep-research agents and for agent-security folks who care about long-form synthesis rather than single-hop QA. It deserves a serious referee. I would engage with it, cite the planning-layer framing and the transplant design, and push for live-web validation and fuller evaluation snapshots.","headline":"Solid planning-layer attack paper with a real transplant isolation and a useful defense; Network numbers are an offline upper bound, not a live-web guarantee.","tokens_in":23133,"tokens_out":619,"would_cite":true,"duration_ms":6094,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.5","headline":"Coordinated adversarial documents can hijack a deep research agent's planning loop, turning local retrieval injection into report-level contamination.","keywords":["deep research agents","planning-layer poisoning","retrieval-augmented generation","adversarial documents","report contamination","subtask hijacking","Root Query Anchoring","PRISM metric"],"falsifier":"Seed the same five FORGE documents into a live search index under realistic ranking (domain authority, freshness, spam filters) on the paper’s 25 queries; if produced reports stay near the no-attack PRISM baseline while the offline reranker still reports high PRISM, the network attack claim as stated fails.","tokens_in":22999,"feed_emoji":"🕵️","tokens_out":960,"duration_ms":19117,"temperature":0.7,"pith_summary":"Deep research agents break open-ended questions into subtasks, retrieve evidence over multiple rounds, and synthesize long reports. That recursive plan–retrieve–synthesize loop creates a planning-layer attack surface: documents that enter early retrieval can steer which follow-up questions the agent asks next, so a local injection compounds into report-level contamination. The paper introduces FORGE, a two-level attack that fabricates an internal reasoning chain inside each adversarial document and coordinates those documents into a convergent multi-source argument, plus PRISM, a metric that weights infected report claims by cognitive type rather than binary success. Across 25 queries, five network-injected FORGE documents reach 26.4% PRISM and show depth migration, in which deeper recursion shifts poisoned framing into factual premises. Root Query Anchoring, which re-ties recursive follow-ups to the original root query, cuts PRISM from 38.5% to 18.3% on a defense subset while raising report utility.","feed_headline":"Five fake documents can hijack a research agent's plan","feed_subtitle":"Coordinated web fakes steer multi-round investigation into report contamination; root-query anchoring cuts the damage.","key_machinery":"FORGE: a two-level poisoning construction in which each adversarial document embeds a fabricated local reasoning chain ending in an assigned claim, and the full set is organized as a distributed argument chain so the documents read as convergent multi-source evidence and steer planner subtasks toward the target narrative. PRISM scores report harm as the weight-share of infected claims across five cognitive types (factual through framing). The planning-layer transplant isolates subtask hijacking as the decisive channel.","core_discovery":"Because deep research agents couple retrieval to planning, adversarial documents that enter the initial retrieval pool can hijack subtask generation and convert local injection into report-level contamination. FORGE achieves this by combining intra-document fabricated reasoning chains with inter-document argument coordination; measured by PRISM, Network FORGE reaches 26.4% at five injected documents across 25 queries. A transplant experiment shows the poisoned subtask list—not extra poisoned evidence under a fixed plan—is the dominant amplification channel. Root Query Anchoring reduces PRISM from 38.5% to 18.3% while improving utility, showing that constraining planning drift closes much of","pith_inferences":["The same planning-layer hijack likely applies to any multi-hop agent that lets intermediate evidence rewrite the next tool-use or sub-goal list, not only research-report agents.","Live deployment would force attackers to survive domain authority and anti-spam ranking, so real-world PRISM may be lower unless adversaries also control high-authority sources.","Pairing Root Query Anchoring with retrieval-time filters would close both channels an adaptive attacker would exploit once planning alone is constrained.","Human-supervised document construction currently limits attacker scale; fully automated FORGE pipelines would change the economics the paper deliberately withholds."],"forward_implications":["Defenses that only filter retrieval or sanitize outputs leave the planning channel open and will not stop report-level contamination.","Greater research depth can make poisoning less visible by migrating framing into factual premises, so deeper agents are not automatically safer.","Report-level harm metrics must weight claim type; binary attack-success rates understate high-influence causal and framing contamination.","Re-anchoring recursive planning to the root query can cut planning-layer poisoning without retraining or retrieval classifiers.","Topics that invite causal interpretation or broad framing are more vulnerable than structured comparison tasks."],"fun_headline_variants":["Five fake docs hijack deep research agent subtask plans","FORGE turns injected pages into report-level contamination","Planning poison, not extra evidence, drives agent report takeover","Network FORGE hits 26.4% PRISM with five planted documents","Root Query Anchoring cuts PRISM from 38.5% to 18.3%"],"cache_read_input_tokens":16512,"weakest_assumption_plain":"The offline network simulation—dropping adversarial documents into an API-returned pool and reranking with a simple BM25-plus-embedding score—faithfully bounds real web competition, including domain authority, freshness, and anti-spam filters.","fun_headline_variants_meta":{"raw":{"variants":["Five fake docs hijack deep research agent subtask plans","FORGE turns injected pages into report-level contamination","Planning poison, not extra evidence, drives agent report takeover","Network FORGE hits 26.4% PRISM with five planted documents","Root Query Anchoring cuts PRISM from 38.5% to 18.3%"]},"model":"grok-4.5","effort":"low","cost_usd":0.006454,"raw_usage":{"total_tokens":1603,"prompt_tokens":791,"num_sources_used":0,"completion_tokens":75,"cost_in_usd_ticks":64540000,"prompt_tokens_details":{"text_tokens":791,"audio_tokens":0,"image_tokens":0,"cached_tokens":0},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":737,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":791,"tokens_out":75,"duration_ms":6030,"temperature":1.0,"reasoning_tokens":737,"cache_read_input_tokens":0,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-07-11T14:38:38.207610+00:00","model_set":{"reader":"grok-4.5"},"falsifier":"Seed the same five FORGE documents into a live search index under realistic ranking (domain authority, freshness, spam filters) on the paper’s 25 queries; if produced reports stay near the no-attack PRISM baseline while the offline reranker still reports high PRISM, the network attack claim as stated fails.","supporting_citations":[],"review_version":1}